Biometric approval rate expresses the proportion of approvals within the analyzed scope. To interpret the number, you must specify the counting unit, such as session or user, the period, and the layers evaluated. The result depends on the biometric engine threshold, the quality of the reference image used for enrollment, and the set of active security controls. Without these definitions, comparisons between products can be misleading.
This post describes the layers that determine approval rate, explains how the biometric threshold directly affects conversion, and provides the questions product and fraud managers should ask before comparing vendor numbers.
What does biometric approval rate measure?
Biometric approval confirms that the system recognized the user as the enrolled person under the configured security conditions. The opposite—rejection—can happen for completely different reasons: the liveness frame was considered invalid, the similarity score did not reach the configured threshold, or the capture channel was identified as compromised.
All three produce the same outcome for the user—the transaction does not go through. When consolidated in vendor reports, they make comparisons misleading. A system with a 4% rejection rate that includes blocked attacks reports a different number from a system with a 4% rejection rate composed only of legitimate users with valid captures.
Approval rate as a business metric only makes sense when accompanied by a definition of what is being counted.
Which system layers affect user approval?
Approval depends on different analysis layers and the settings adopted in the integration. To understand a rejection, it is important to identify which control was triggered and distinguish security blocks from difficulties experienced by legitimate users.
Liveness: evaluates liveness signals in the capture. Conditions such as lighting and positioning can also affect capture and analysis. Correctly blocked presentation attacks must be distinguished from rejected legitimate attempts.
Biometric match: compares the captured image with the reference and returns a similarity score. The decision depends on the configured threshold; an adequate capture does not guarantee that the score will reach it.
Anti-injection: checks for signs that the environment or capture channel has been compromised. These controls can also reject legitimate attempts. BPCER measured in the laboratory should not be confused with the operational rejection rate per session.
Additional capture and content controls: settings such as occlusion detection, passport capture requirements, and inappropriate content detection (NSFW) can also influence the result. The impact depends on which controls are enabled and the criteria adopted in the integration.
Therefore, an aggregate rejection rate is not enough to diagnose the experience. Rejection reasons must be separated and active settings considered, while keeping the period and unit of analysis explicit.
How does the biometric match threshold define approval rate?
The biometric engine does not approve or reject on its own—it assigns a similarity score between the captured image and the enrollment reference. The operator defines the threshold. Above the threshold, approved; below it, rejected.
Fortface's current table presents match levels from 0 to 16. The table below shows the false acceptance rate (FAR) and false rejection rate (FRR) for each Fortface match level.
Match level — FAR and FRR by match level
| Match Level | False Acceptance Rate (FAR) | False Rejection Rate (FRR) |
|---|---|---|
| 16 | 1/125,000,000 | 0.0027 (0.27%) |
| 15 | 1/62,500,000 | 0.0026 (0.26%) |
| 14 | 1/41,700,000 | 0.0026 (0.26%) |
| 13 | 1/31,300,000 | 0.0019 (0.19%) |
| 12 | 1/25,000,000 | 0.0019 (0.19%) |
The current recommendation is to use match level 13, with a false acceptance rate (FAR) of 1 in 31.3 million and a false rejection rate (FRR) of 0.19%.
The configuration is dynamic: high-value transactions can operate at a higher match level, with higher rejection accepted as the cost of additional security.
When a vendor reports an approval rate without specifying the match level, the number is not comparable to anything.
Why are liveness rejection and biometric match rejection different metrics?
Different causes, same result for the user.
Liveness rejection means that the PAD (Presentation Attack Detection) or capture controls did not accept the frame. The user may be rejected because the lighting was outside the expected range, because the system identified a possible presentation attack—or because the user was actually attempting an attack. Without separation, both groups appear in the same count.
Match rejection means that the similarity score was below the threshold. The capture was valid; the system recognized a real person but did not identify enough similarity with the reference image. Enrollment quality and facial aging are common causes at this layer.
This separation matters for diagnosis. Liveness and anti-injection rejections must be identified separately in reports. A security rejection should not automatically be classified as a false non-match for a legitimate user or as confirmed fraud. The analysis must distinguish the layer that rejected the session and the identified cause before guiding changes to capture, liveness, or anti-injection controls.
How can you compare vendor approval rates without comparing different things?
A number without context is not comparable. Before comparing approval rates between vendors, align the counting unit and the period: a result per session is not equivalent to a result per user on the first session of the day or through the second session. The four variables below must also be considered.
What match level is configured? A system at match level 4 approves more users than a system at match level 8—and accepts proportionally more false acceptance risk. Comparing approval without aligning the threshold compares thresholds, not performance.
What is included in the reported rejection rate? Rejections due to a detected attack, insufficient capture quality, and a score below the threshold have different causes. A number that consolidates all three does not show where conversion is being lost.
Under what conditions were the reference images captured? Legacy images or images imported from other systems reduce the similarity score in matching. A benchmark using images captured by the vendor's own SDK produces a better approval rate—and may not reflect the operational reality of a customer migrating from another system.
What is the profile of the tested population? Age range, predominant lighting conditions, and database diversity directly affect the metrics. A benchmark conducted with a specific profile may not apply to the customer's user base.
With these variables aligned, the comparison reflects product performance. Without them, it reflects the vendor's methodological choices.
What do laboratory tests show about Fortface?
In the injection attack detection (IAD) test conducted by the Antisec laboratory, Fortface's anti-injection module had a BPCER of 2%. This indicator represents the proportion of legitimate attempts rejected under the test conditions.
The result refers to the module and scenario evaluated in the laboratory. It does not represent the production rejection rate or approval across the complete journey.
To compare solutions, consider the scope of each test, its methodology, and the reports supporting the results.
Want to learn about Fortface's production indicators and understand how to evaluate them in the context of your operation? Talk to our team.
Learn more
To understand how injection attacks affect the capture channel—and why this layer has a metric separate from biometric approval—the post Injection Attacks in Facial Biometrics: The Three Vectors and How to Detect Them covers the vectors and the CEN/TS 18099:2024 evaluation methodology.
For the impact of choosing a second vendor on approval metrics and how to split traffic by risk segment, the post What to Ask Before Adding a Second Biometrics Vendor discusses the operational evaluation criteria.
